Open
Description
Handle
defsec
Vulnerability details
Impact
On the GovernorAlpha contract, function veto has been added. Although the function behaviour is expected, duplicate veto process has not been checked on that function.
Proof of Concept
- Navigate to following contract line. (https://github.com/code-423n4/2021-11-vader/blob/607d2b9e253d59c782e921bfc2951184d3f65825/contracts/governance/GovernorAlpha.sol#L562)
function veto(uint256 proposalId, bool support) external onlyCouncil {
ProposalState _state = state(proposalId);
require(
_state == ProposalState.Active || _state == ProposalState.Pending,
"GovernorAlpha::veto: Proposal can only be vetoed when active"
);
Proposal storage proposal = proposals[proposalId];
address[] memory _targets = proposal.targets;
for (uint256 i = 0; i < _targets.length; i++) {
if (_targets[i] == address(this)) {
revert(
"GovernorAlpha::veto: council cannot veto on proposal having action with address(this) as target"
);
}
}
VetoStatus storage _vetoStatus = proposal.vetoStatus;
_vetoStatus.hasBeenVetoed = true;
_vetoStatus.support = support;
if (support) {
queue(proposalId);
}
emit ProposalVetoed(proposalId, support);
}
/**
- The veto progress can be completed per proposal twice.
Tools Used
None
Recommended Mitigation Steps
Consider to check if proposals vetoed before.
VetoStatus storage _vetoStatus = proposal.vetoStatus;
require(!_vetoStatus.hasBeenVetoed, "Vetoed before");